Hi guys,
I'm in trouble configuring my web service site, please help!
The problem is I want to authenticate my clients by client certificate and only the one we issued. So I configured IIS to map this certificate to a windows account. Then in my web service application, I add following for authorization,
<authorization>
<allow users="MyUser"/>
<deny users="*"/>
</authorization>
In IIS authentication settings, I enabled anonymous access and impersonation. When I accessed the web service using another client certificat which was also acceptable by server but not mapped to a windows account, it could still pass through.
Did I do anything wrong? And what's the typical settings for such scenario?
...
Go to the complete details ...